The Case Against Huawei

https://www.baldingsworld.com/2020/01/15/the-case-against-huawei/

Is Huawei a private corporation?

No, Huawei is effectively a state owned corporation in the People’s Republic of China under the Communist Party.

Technically, the firm known as Huawei is Huawei Technologies. Huawei Technologies is 99% owned by Huawei Investment Holdings. Huawei Investment Holdings is completely owned by the Huawei Investment Holdings Trade Union Committee.

According to Chinese law, trade union committees are classified as “public” or “mass” organizations. Public organizations do not have shareholders as they are recognized under Chinese law as legal persons or entities in their own right. An example of a public organization would be the Communist Youth League.

The Huawei Investment Trade Union Committee is under the umbrella of the All China Federation of Trade Unions. The ACFTU works on an umbrella structure in that firms are under local branches. Local branches are subsumed under city branches which are under county level branches all the way up to the national branches. ACFTU employees are treated almost as civil servants serving the Party and government interests being paid on civil servant pay scales. The current head of the ACFTU which ultimately owns the controlling stake in Huawei Investment Holding is the Vice Chairperson of the Standing Committee of the National People’s Congress.

While Huawei continues to publicly proclaim they are a private firm, the corporate and legal records clearly prove they are “public” or “mass” organization that is effectively state owned. Interestingly, in a conference call with journalists, Huawei personnel actually stated that this is their legal status despite their continued public declarations.

Does it Matter Who Formally Owns Huawei?

No, it does not. The Chinese Communist Party has placed CCP official in oversight roles in all major companies. This includes carrying out CCP directives from small such as increasing public spirit and studying Xi thought to bigger issues such as access to data for all public officials. In other words, Huawei is not a private company and the CCP has directed all companies to follow the Party.

Does Huawei Work With Chinese Security Services of Various Kind?

Huawei has a long and intimate history with Chinese security services of all types. Founder Ren Zhengfei has a well documented background as a senior commander of the People’s Liberation Army. Due to the timing and opacity of documentation about his time in the PLA, there is some confusion about his exact rank or status though it is clear that he was rather senior. It has also been raised that at the time there were few choices for able bodied men which also has some truth.

What has been widely overlooked however is the broader depth of early personnel links between Huawei and the People’s Liberation Army. Numerous leaders of Huawei, both past and present, have long standing and deep ties to the PLA across disciplines or background. As one example, the Chief Legal Officer of Huawei who has appeared regularly in foreign media proclaiming the lack of ties between Huawei and the PLA actually received his Phd in electronics and communications from the National University of Defense Technology also known as the People’s Liberation Army National University of Defense Science and Technology. This is a military university under the direct control of the China Central Military Commission. Put another way, the Chief Legal Counsel a leader of Huawei declaring its lack of ties to the PLA received all his university degrees from a PLA university in electronics and communications before joining Huawei. There are many other examples of senior Huawei personnel past and present with similar links to the military or security services.

Beyond historical personnel links, Huawei maintains very close ties to the PLA, Ministry of State Security which focuses on external intelligence, and the Public Security Bureau which focuses on domestic intelligence. Huawei researchers have demonstrated dual appointments with PLA research units which one case likely falls under the Strategic Support Force which leads Chinese cyber warfare and intelligence gathering efforts. In another instance, a Huawei employee doubles as the MSS liaison or representative. Huawei personnel work in depth with the PSB building domestic surveillance and censoring technology. There are extensive, in depth, and long historical links between Huawei and all sectors of Chinese state security.

Does China provide state support for Huawei?

There is a long history of China providing state support for Huawei. Dating back to the late 1990’s and early 2000’s, the China Development Bank was providing low cost financing for Huawei customers. This typically took the form of guaranteed financing to Huawei for customers that were many times annual revenue updated every few years. Additionally, Huawei received a wide variety of grants and tax breaks to promote research, jobs, and low cost land acquisition. By one report, this amount topped more than $75 billion. The ability of Huawei to essentially guarantee financing provided a major boost to sales driven by Beijing foreign policy objectives through the China Development Bank.

State support however comes in other forms. For instance, Huawei has been involved in joint ventures with Chinese telecommunications carriers and local governments which appear to provide funding for operations and research. In other words, there appears to be some cost sharing in some cases for local operations.

In other cases, Huawei researchers work with professors or researchers from PLA or other military linked universities on research covering a variety of topics from general network reliability, to wifi, encryption, and 5G to name a few. Huawei technical experts have been on technical commissions with PLA and security experts domestically focused on external threats and capabilities as well as having broad networks with PLA and intelligence electronics and signals research.

Is Huawei the Technological Leader in 5G?

No. Many patents have been filed pertaining to 5G but this does not mean all of the patents are truly useful or important to 5G products. Based upon the widely used technology industry metric of “standard and essential” patent, Huawei ranks generally anywhere from 4th to 6th globally. Other firms like Nokia, Ericsson, Samsung, LG, and Qualcomm are leaders with Intel and Sharp ranking just behind Huawei and ZTE. While Huawei attempts to paint themselves as a market and technological leader, there simply is no evidence that they are a technological leader in 5G.

Does Huawei Engage in Intellectual Property Theft or Intelligence Gathering For China or Itself?

Yes, on both accounts. We have clear evidence of Huawei personnel gathering technical data on competitors products. Additionally, there is clear records of Huawei personnel engaging in behavior that states foreign data collection capabilities which ties back geographically and time wise to known events. Given the amount of offensive hacking capabilities Huawei has at multiple locations throughout China and other offices in countries with widely recognized superior cyber threat capabilities, the threat to countries by Huawei should be taken quite seriously. Finally, Huawei personnel talk about putting information interception capabilities into domestic and foreign destination hardware. While we cannot specifically discern intent or end use, Huawei personnel clearly state the capabilities at hand.

Is there Evidence Huawei or China Are Using Existing Capabilities to Gather Data on Foreign Firms or Individuals?

Yes. Huawei and China maintains extensive databases on foreign individual, firms, including but not limited to work product, intellectual property, facial characteristics, camera IPs, call records, and others. We cannot tell whether this is being conducted via existing backdoors in Huawei gear but we can tell it is data that should not necessarily be in Chinese databases.

Is Huawei Network Gear a Security Risk?

Yes. This has been said by every foreign government entity that has looked at it including the United Kingdom Huawei Cyber Security Evaluation Center and the Czech National Cyber Security Center. FiniteState which produced a detailed report of Huawei products on their security vulnerabilities came to the conclusion that:

Huawei devices quantitatively pose a high risk to their users. In virtually all categories we studied, we found Huawei devices to be less secure than comparable devices from other vendors. Through analysis of device firmware, we discovered that there were hundreds of cases of potential backdoor vulnerabilities – improper default configurations that could allow Huawei or a malicious attacker to covertly access a user’s device. These vulnerabilities manifested in the form of hard-coded, default user accounts and passwords, and several types of embedded cryptographic keys. The study also found that each Huawei device had a large number of known vulnerabilities associated with the third-party and open-source libraries embedded within the firmware. On average, there were 102 known vulnerabilities (CVEs) associated with each firmware, a significant percentage of which were rated as high or critical in their severity.

While intent is difficult to discern as we do not know why specific vulnerabilities made it through into production devices, Huawei devices have significantly more known vulnerabilities than comparable products. Given the state link with employees declaring their activity and the data found in China, it is not a stretch to consider this is being used to harvest information.

Is Huawei a National Security Threat?

Defining national security broadly yes. For instance, we know that Huawei is continuing to deal with Iran having evidence of their continued dealings as late as November 2018. Huawei built the mobile network for North Korea. They are one of the dominant cloud providers of data collected on foreigners for China. They have provided security, surveillance, and censoring services to authoritarian governments. Even if we exclude the question of whether there are backdoors, very weak, or problematic security on their network gear, defined more broadly, they clearly pose a national security risk to democratic states.

Is Huawei a Human Rights Violator?

Yes, at home and abroad. Huawei is heavily involved in Xinjiang training police forces and prison officials in the use of technology covering everything from facial and gait recognition, population monitoring, and cloud services to capture the flow of data. They are direct service providers to local governments some of which have been placed on the United States government entity list. Though Huawei was placed on the entity list for different reasons, their work for human rights